a missunderstanding here…
1-
i did the same… here is the rule in Event Console for logwatch …with Rewrite Application
and here are the Events forwarded from logwatch to EC
2-
here is the Event check stat
and here is the Event Check in Monitoring
all this is not satisfying me - because i wanted in the details of the check all the log files found sorted by their fullname … i wanted all the hunderts logfiles unter /root/path/* in one check showed in the details…
and i could made this only with my own created bash script as a locat check.
am happy with it like this thank you:))